diff options
| author | Kees Cook <[email protected]> | 2024-04-24 15:01:01 -0700 |
|---|---|---|
| committer | Johannes Berg <[email protected]> | 2024-05-03 09:20:26 +0200 |
| commit | 838c7b8f1f278404d9d684c34a8cb26dc41aaaa1 (patch) | |
| tree | dda74becf98e11f5e06e983067f2ebca3c0dc75a /drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c | |
| parent | 3d913719df14c28c4d3819e7e6d150760222bda4 (diff) | |
wifi: nl80211: Avoid address calculations via out of bounds array indexing
Before request->channels[] can be used, request->n_channels must be set.
Additionally, address calculations for memory after the "channels" array
need to be calculated from the allocation base ("request") rather than
via the first "out of bounds" index of "channels", otherwise run-time
bounds checking will throw a warning.
Reported-by: Nathan Chancellor <[email protected]>
Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
Signed-off-by: Kees Cook <[email protected]>
Tested-by: Nathan Chancellor <[email protected]>
Link: https://msgid.link/[email protected]
Signed-off-by: Johannes Berg <[email protected]>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/debugfs-vif.c')
0 files changed, 0 insertions, 0 deletions